I have a customer who created a dashboard with 28 unique searches. (Using Splunk 6.1.1). It's some cool stuff, but, that's nuts. A lot of the searches are simply different timeframes - one day in one chart, and 1 month in the other. Any suggestions on how to prevent 28 unique searches?
Easiest option would be to create a saved search for the each unique search. Then in dashboard call the saved search with different time range.
<dashboard> <label>Splunk Home</label> <description/> <row> <single> <title>Last 15 Minute</title> <searchString>|savedsearch splunk_internal_count</searchString> <earliestTime>-15m</earliestTime> <latestTime>now</latestTime> </single> </row> <row> <single> <title>Last 30 Minutes</title> <searchString>|savedsearch splunk_internal_count</searchString> <earliestTime>-30m@m</earliestTime> <latestTime>now</latestTime> </single> </row> </dashboard>
As an alternative or addition to post processing, you could accelerate, summarize, or schedule historic searches like the thirty day one because that's doing a lot of things over and over again without changes to the data.
Take schedule as an example, you could have the search run over -30d@d to @d every night at 1 AM and everyone loading the dashboard that day gets the canned results from 1 AM.
That would be the best solution for these kind of situations. It may require search/postprocess search formation based on the requirements. Some reading can be done from here.
Thanks. That still seems like a lot of unnecessary over-lap. I recall the term "post-processor" for dashboards. Would that be appropriate? If so, can someone point me to links on how to do it?